The UK Gambling Commission has raised the money laundering risk rating for the gambling software sector from low to medium. The change forms part of the regulator’s 2026 assessment of money laundering and terrorist financing risks across Britain’s licensed gambling industry.
The Commission attributed the increase to weaknesses in business-to-business relationships, cross-border software supply, and the possibility of licensed products reaching unlicensed websites through third parties. Gambling software was the only sector to receive a different overall rating from the regulator’s previous assessment.
What the UKGC’s Software Risk Upgrade Means
The assessment covers risks identified between 1 April 2023 and 31 October 2025. Licensed businesses are expected to consider the findings when reviewing their own money laundering and terrorist financing risk assessments, policies, and controls.
- The sector rating increased: Remote and non-remote gambling software moved from low to medium money laundering risk.
- B2B checks are a priority: Inadequate due diligence on business customers and testing houses was rated high risk.
- Supply-chain monitoring is under scrutiny: The regulator identified software resale to unlicensed websites as a new risk.
- Cryptoasset exposure carries a high rating: Transactions involving cryptoassets were classified as high risk within the software sector.
- Cross-border relationships require closer review: Partners based in or connected to high-risk jurisdictions were rated a medium risk.
- The findings affect existing compliance duties: Operators must take Commission guidance into account under Licence Condition 12.
B2B Relationships Drive the Higher Risk Rating
The Commission said gambling software can pass through several businesses before reaching the operator that makes it available to customers. Cross-border contracts, resellers, aggregators, testing companies, and other intermediaries can make it more difficult for suppliers to identify where their products ultimately appear.
The regulator warned that licensed software may reach unlicensed website operators without being supplied to them directly. This can occur when a licence holder does not sufficiently monitor third-party contracts, onward distribution or the activities of its commercial partners.
Inadequate due diligence on B2B customers and testing houses received an overall high-risk rating. The likelihood of these failures occurring was rated medium, while their potential impact was rated high. The likelihood of these failures occurring was rated medium, while their potential impact was rated high. Checks on business investors were classified as medium risk after the Commission identified increased concerns around the sources of investment and corporate funding.
The findings extend the regulator’s existing pressure on licensed businesses to examine the wider companies supporting their operations. The Commission has previously called on operators and suppliers to separate themselves from businesses serving unlicensed gambling markets, including technology providers, affiliates, and payment companies.
Cryptoasset Transactions Receive High-Risk Classification
Cryptoasset transactions were added as a new high-risk vulnerability for the gambling software sector. The Commission said software businesses may receive cryptoassets directly or enter commercial and investment relationships with companies involved in cryptoasset activity.
The assessment includes a case study involving a software company that received a loan ultimately funded by revenue from a remote casino offering cryptoasset facilities. The Commission found that checks on the casino were insufficient and that the business promoted methods for customers to circumvent geographic blocking controls.
A separate case study identified weaknesses in checks conducted on investors in an initial coin offering. Source-of-funds checks had not been completed for some investors, identity documents could not always be matched to investor records and one investor had previously been convicted of a money laundering offence.
The classification concerns financial-crime exposure rather than a general policy decision on the use of digital assets. It comes as the regulator separately examines whether crypto payments could eventually operate within the licensed British gambling market. Any future payment framework would remain subject to consumer protection, source-of-funds and financial-crime controls.
Licence Condition 12 Requires Operators to Review the Findings
The Commission’s assessment is intended to inform the risk evaluations maintained by licensed businesses. Under Licence Condition 12.1.1 of the Licence Conditions and Codes of Practice, applicable operators must assess the risk of their businesses being used for money laundering or terrorist financing and maintain appropriate policies, procedures, and controls.
The regulator said the assessment will also shape its licensing, compliance, and enforcement priorities. The frequency and intensity of regulatory supervision may be informed by the risk profile assigned to individual businesses and sectors.
The software upgrade follows a recent £4.75 million regulatory settlement involving Evolution Malta Holding Limited. The Commission found that games supplied by the company had appeared on six unlicensed websites accessible from Great Britain and identified weaknesses in its risk assessment, customer due diligence, and supply-chain oversight.
The regulator said suppliers must understand who receives their products, where those products are accessed, and whether controls work in practice. Its investigation considered the failings serious enough for licence suspension to have been considered before the company introduced corrective measures.